This vulnerability allows the Avantra application to write sensitive data, including encrypted secrets, directly into its log files. Because the logs are not sanitized, an attacker who can read those files may gain access to confidential information. Classified as CWE-532, the weakness is a resource exposure of sensitive data, leading primarily to a loss of confidentiality that could enable credential theft or further system compromise.

Avantra versions prior to 25.3.0 running on Linux or Windows are affected. This includes all installations of syslink software AG Avantra that have not been upgraded to the 25.3.0 release or later.

The CVSS score of 7.5 indicates high severity. Though the EPSS score is not available, the ability for an attacker to read log files—whether through local access or by exploiting another vulnerability—means the risk remains significant. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale exploitation is known at this time. The likely attack vector involves obtaining file read permissions on the Avantra log directories, after which sensitive data can be extracted without requiring privilege escalation.